Strategy, Governance and Training
Policy and Control Design
We write policies and procedures that meet audit requirements and that your teams can actually follow. Each control's measurement is also defined.
What it is
A policy defines the organization's security decisions and responsibilities. A procedure describes who implements these decisions and the steps involved. A control definition specifies how the practice is measured and what evidence demonstrates it. If these three are not connected, documents may pass audit but are not applied in practice.
Scope
- Information security policy and topic-specific policies such as access, backup and incident management
- Procedures and workflows that fit the teams' daily work
- Owner, frequency and evidence definition for each control
- Simplifying existing documents and resolving contradictions
- Mapping policies to ISO/IEC 27001:2022 Annex A and legal requirements
The need
When organizations need it
- When your documents are adapted from a template and your teams do not follow them.
- When you need a policy set for your first ISO/IEC 27001 certification.
- When an audit finds a gap between policy and practice.
Method
How we work
-
Review
We compare existing documents with actual team practices.
-
Design
We write policies, procedures and control definitions together with your teams.
-
Mapping
We link each control to the relevant standard clause and legal requirement.
-
Rollout
We set the approval, communication and review schedule.
Outcome
What you have at the end
You have linked policies, procedures and control definitions ready for management approval. Each control has an owner and defined evidence.
Frequently asked questions
Do you use ready-made templates?
We use established frameworks for structure. Content is written based on your organization's systems, teams and processes.
How many policies do we need?
The number depends on your organization's size and obligations. The goal is for each control to be defined once, in a single document, without contradictions.
Strategy, Governance and Training
Other services in this area
Let's talk about this service.
Tell us briefly what you need. We will agree on the scope and timing together in the first meeting.
Schedule a Meeting